Pluck-cms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-70376 Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) fCritical 9.6 · Aug 5, 2026
• CVE-2026-54416 Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','phpHigh 7.2 · Aug 5, 2026
• CVE-2025-46099 In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routinHigh 7.2 · Jul 23, 2025
• CVE-2024-43042 Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.Critical 9.8 · Aug 16, 2024
• CVE-2023-50564 An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading aHigh 8.8 · Dec 14, 2023
• CVE-2023-27083 An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.High 7.2 · Jun 22, 2023
• CVE-2020-20969 File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.High 7.2 · Jun 20, 2023
• CVE-2020-20919 File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file.High 7.2 · Jun 20, 2023
• CVE-2020-20918 An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.High 7.2 · Jun 20, 2023
• CVE-2020-20718 File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() pCritical 9.8 · Jun 20, 2023
• CVE-2022-27432 A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to accountHigh 8.8 · Mar 29, 2022
• CVE-2022-26965 In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.High 7.2 · Mar 18, 2022
• CVE-2021-27984 In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.High 8.1 · Dec 10, 2021
• CVE-2021-31746 Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbiCritical 9.8 · Dec 10, 2021
• CVE-2021-31745 Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform.High 7.5 · Dec 10, 2021
• CVE-2020-20951 In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.Critical 9.8 · May 18, 2021
• CVE-2020-18198 Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.phHigh 8.8 · May 17, 2021
• CVE-2020-18195 Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /adminHigh 8.8 · May 17, 2021
• CVE-2020-29607 A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" High 7.2 · Dec 16, 2020
• CVE-2020-21564 An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11.High 8.8 · Sep 30, 2020
• CVE-2019-1010062 PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type.Critical 9.8 · Jul 16, 2019
• CVE-2019-11344 data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .tCritical 9.8 · Apr 19, 2019
• CVE-2019-9050 An issue was discovered in Pluck 4.7.9-dev1.High 7.2 · Feb 23, 2019
• CVE-2018-16634 Pluck v4.7.7 allows CSRF via admin.php?action=settings.High 8.8 · Dec 4, 2018
• CVE-2018-11736 An issue was discovered in Pluck before 4.7.7-dev2.Critical 9.8 · Jun 5, 2018